6380c6a0cfeaa8c91b5c4de75539255c14fe313934ec973179d3b4d6aac79c11

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25-03-2024 17:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de9dd0c28688277931a9dfe95f09c5c0.exe
Size

302KB
MD5

de9dd0c28688277931a9dfe95f09c5c0
SHA1

a2e2cfac5bc021a692f71857aa31250869c2e6c6
SHA256

6380c6a0cfeaa8c91b5c4de75539255c14fe313934ec973179d3b4d6aac79c11
SHA512

3dd1e198cf4b59aff2e66537faf29d8c7c02d636d8bc58e01984c548655c352502a9d9a456e62536eede1d047e286d7f2ff73a18db4f5c0132d47d1fcf43fa85
SSDEEP

6144:wfgpnTfV/4RJXkcNT43KS3KD5pJi7NVEMbOM0lcHUfh5C6KgN5E57:ZlJkh43Y5i0nlcHUJMx

Score

8^/10

persistence

Malware Config

Signatures

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ravmon.exe	de9dd0c28688277931a9dfe95f09c5c0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvMonXP.exe	de9dd0c28688277931a9dfe95f09c5c0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe\debugger = "IFEOFILE"	de9dd0c28688277931a9dfe95f09c5c0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe\debugger = "IFEOFILE"	de9dd0c28688277931a9dfe95f09c5c0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guard.exe	de9dd0c28688277931a9dfe95f09c5c0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safe.exe	de9dd0c28688277931a9dfe95f09c5c0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe\debugger = "IFEOFILE"	de9dd0c28688277931a9dfe95f09c5c0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavstart.exe	de9dd0c28688277931a9dfe95f09c5c0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe	de9dd0c28688277931a9dfe95f09c5c0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpfwsvc.exe	de9dd0c28688277931a9dfe95f09c5c0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe	de9dd0c28688277931a9dfe95f09c5c0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpfwsvc.exe\debugger = "IFEOFILE"	de9dd0c28688277931a9dfe95f09c5c0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sched.exe\debugger = "IFEOFILE"	de9dd0c28688277931a9dfe95f09c5c0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avast.exe\debugger = "IFEOFILE"	de9dd0c28688277931a9dfe95f09c5c0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe\debugger = "IFEOFILE"	de9dd0c28688277931a9dfe95f09c5c0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvMonXP.exe\debugger = "IFEOFILE"	de9dd0c28688277931a9dfe95f09c5c0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavstart.exe\debugger = "IFEOFILE"	de9dd0c28688277931a9dfe95f09c5c0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcenter.exe	de9dd0c28688277931a9dfe95f09c5c0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe	de9dd0c28688277931a9dfe95f09c5c0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe	de9dd0c28688277931a9dfe95f09c5c0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe	de9dd0c28688277931a9dfe95f09c5c0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe\debugger = "IFEOFILE"	de9dd0c28688277931a9dfe95f09c5c0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwmain.exe\debugger = "IFEOFILE"	de9dd0c28688277931a9dfe95f09c5c0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avast.exe	de9dd0c28688277931a9dfe95f09c5c0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safe.exe\debugger = "IFEOFILE"	de9dd0c28688277931a9dfe95f09c5c0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ravmon.exe\debugger = "IFEOFILE"	de9dd0c28688277931a9dfe95f09c5c0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavmonD.exe	de9dd0c28688277931a9dfe95f09c5c0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVXP.exe	de9dd0c28688277931a9dfe95f09c5c0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscntfy.exe	de9dd0c28688277931a9dfe95f09c5c0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kav.exe\debugger = "IFEOFILE"	de9dd0c28688277931a9dfe95f09c5c0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runiep.exe	de9dd0c28688277931a9dfe95f09c5c0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe	de9dd0c28688277931a9dfe95f09c5c0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kissvc.exe	de9dd0c28688277931a9dfe95f09c5c0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavsvc.exe	de9dd0c28688277931a9dfe95f09c5c0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe\debugger = "IFEOFILE"	de9dd0c28688277931a9dfe95f09c5c0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpfw32.exe	de9dd0c28688277931a9dfe95f09c5c0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wuauclt.exe	de9dd0c28688277931a9dfe95f09c5c0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavmonD.exe\debugger = "IFEOFILE"	de9dd0c28688277931a9dfe95f09c5c0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwproxy.exe	de9dd0c28688277931a9dfe95f09c5c0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavsvc.exe\debugger = "IFEOFILE"	de9dd0c28688277931a9dfe95f09c5c0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rsaupd.exe	de9dd0c28688277931a9dfe95f09c5c0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kav32.exe\debugger = "IFEOFILE"	de9dd0c28688277931a9dfe95f09c5c0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwproxy.exe\debugger = "IFEOFILE"	de9dd0c28688277931a9dfe95f09c5c0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kav.exe	de9dd0c28688277931a9dfe95f09c5c0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe	de9dd0c28688277931a9dfe95f09c5c0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avguard.exe	de9dd0c28688277931a9dfe95f09c5c0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kav32.exe	de9dd0c28688277931a9dfe95f09c5c0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwmain.exe	de9dd0c28688277931a9dfe95f09c5c0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runiep.exe\debugger = "IFEOFILE"	de9dd0c28688277931a9dfe95f09c5c0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sched.exe	de9dd0c28688277931a9dfe95f09c5c0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guard.exe\debugger = "IFEOFILE"	de9dd0c28688277931a9dfe95f09c5c0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avguard.exe\debugger = "IFEOFILE"	de9dd0c28688277931a9dfe95f09c5c0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcenter.exe\debugger = "IFEOFILE"	de9dd0c28688277931a9dfe95f09c5c0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpfw32.exe\debugger = "IFEOFILE"	de9dd0c28688277931a9dfe95f09c5c0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe\debugger = "IFEOFILE"	de9dd0c28688277931a9dfe95f09c5c0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe	de9dd0c28688277931a9dfe95f09c5c0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVXP.exe\debugger = "IFEOFILE"	de9dd0c28688277931a9dfe95f09c5c0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kwatch.exe	de9dd0c28688277931a9dfe95f09c5c0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rsaupd.exe\debugger = "IFEOFILE"	de9dd0c28688277931a9dfe95f09c5c0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wuauclt.exe\debugger = "IFEOFILE"	de9dd0c28688277931a9dfe95f09c5c0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe\debugger = "IFEOFILE"	de9dd0c28688277931a9dfe95f09c5c0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kissvc.exe\debugger = "IFEOFILE"	de9dd0c28688277931a9dfe95f09c5c0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kwatch.exe\debugger = "IFEOFILE"	de9dd0c28688277931a9dfe95f09c5c0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscntfy.exe\debugger = "IFEOFILE"	de9dd0c28688277931a9dfe95f09c5c0.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	de9dd0c28688277931a9dfe95f09c5c0.exe

Executes dropped EXE 2 IoCs

pid	Process
4560	jbmao45server.exe
4940	svohst.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\svohst.exe	svohst.exe
File created	C:\Windows\SysWOW64\Deleteme.bat	svohst.exe
File created	C:\Windows\SysWOW64\Deleteme.bat	jbmao45server.exe
File created	C:\Windows\SysWOW64\svohst.exe	jbmao45server.exe
File opened for modification	C:\Windows\SysWOW64\svohst.exe	jbmao45server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe
2600	de9dd0c28688277931a9dfe95f09c5c0.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2600	de9dd0c28688277931a9dfe95f09c5c0.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2600	de9dd0c28688277931a9dfe95f09c5c0.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 4560	2600	de9dd0c28688277931a9dfe95f09c5c0.exe	90
PID 2600 wrote to memory of 4560	2600	de9dd0c28688277931a9dfe95f09c5c0.exe	90
PID 2600 wrote to memory of 4560	2600	de9dd0c28688277931a9dfe95f09c5c0.exe	90
PID 4940 wrote to memory of 2168	4940	svohst.exe	98
PID 4940 wrote to memory of 2168	4940	svohst.exe	98
PID 4940 wrote to memory of 2168	4940	svohst.exe	98
PID 4560 wrote to memory of 1568	4560	jbmao45server.exe	102
PID 4560 wrote to memory of 1568	4560	jbmao45server.exe	102
PID 4560 wrote to memory of 1568	4560	jbmao45server.exe	102

C:\Users\Admin\AppData\Local\Temp\de9dd0c28688277931a9dfe95f09c5c0.exe
"C:\Users\Admin\AppData\Local\Temp\de9dd0c28688277931a9dfe95f09c5c0.exe"
1⤵
- Sets file execution options in registry
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Temp\jbmao45server.exe
  "C:\Temp\jbmao45server.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4560
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
    3⤵
    PID:1568

C:\Windows\SysWOW64\svohst.exe
C:\Windows\SysWOW64\svohst.exe -NetSata
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
  2⤵
  PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Temp\jbmao45server.exe

Filesize
476KB

MD5
9683c5af9164dd674242979191e5f710

SHA1
e6e2fbcee33a4cd0e9264e4ff259e38478a1ec2d

SHA256
850174353615b43b7392dec40ab9f27f4afe07d82abacfec690df17a6ef6322f

SHA512
16a97b6bdfa769232e7e17c1585d41a6258f2a4e3b594b0ca7f88ef512fd5237166c64c6b1758c39064e622224ff5df187a7ff27b51b4782605ef65292ecd3fc

Download Submit
C:\Windows\SysWOW64\Deleteme.bat

Filesize
94B

MD5
2d8acbced2c2b174c29fd25796cb1de5

SHA1
f96974cdf63097fcdaa705749c5d746ca95da607

SHA256
22c6d599edd52f784cc069439eba1d336fb071c77fd0380251706a468863c928

SHA512
d9c97b8dd4c66b14dcfcebab2b65639658363f0f53ce52cf40e310ad26ac1c3edfce79ef4e22c43dc090930eeeb35bd73c68202f2c71d71ecc5712327ef07ae4

Download Submit
C:\Windows\SysWOW64\Deleteme.bat

Filesize
104B

MD5
2eec7e3ae21b6acc8fb8cf0a2f7323aa

SHA1
0e6a8a87b7c2848ffec860a6955a44a2c166ad9b

SHA256
78d9742426f406d30f8379f240e595b8ab937b48bc9b0b5099e7e9ecfaa9fac2

SHA512
e13fae2b008a4eb4b88ade4e516d8c8d2521c1c88b53fd4f62863673ade296e708c5b128f1b5b79b18d78f0ed3c94a892207841b664c057a2617ab97aa8bf281

Download Submit
memory/2600-0-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/2600-11-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/4560-12-0x0000000000750000-0x0000000000751000-memory.dmp

Filesize
4KB

Download
memory/4560-23-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/4940-16-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/4940-19-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download